@mano8/astro-media-m8 2.3.0 → 2.3.2

package/CHANGELOG.md

@@ -11,6 +11,91 @@ service line, so the contract can move without moving the major.
 
 ## [Unreleased]
 
+## [2.3.2] - 2026-09-27 · tracks media-service 3.0.2
+
+**Patch.** Admits `@astrojs/react` 7 and Starlight 0.42 as peers, tracks
+the published `@mano8/astro-ui-m8` `1.5.3` and `@mano8/astro-auth-m8`
+`2.7.2`, and adds the fleet's dependency compatibility gate. Peer ranges only
+widen, with both old lines still accepted, and the floors that rise are to
+published releases. The contract stays `media-service-m8@1.1`, range
+`>=2.0.0 <4.0.0`, and the tested service version stays `3.0.2`.
+
+### Added
+
+- **A tree that breaks a declared range fails the build.**
+  `scripts/verify-dependency-compat.mjs` (`npm run verify:dependency-compat`)
+  and `tests/dependency-compat.test.ts`, byte-identical across the fleet's
+  six npm repositories and first shipped in `@mano8/astro-ui-m8` `1.5.3`.
+  The gate reads `npm ls --all --json --long` with peer edges forced on. It
+  names every installed package outside a range declared on it, and every
+  missing required dependency or peer that a required edge reaches. CI runs
+  it after `npm ci`.
+- **`.npmrc` with `legacy-peer-deps=true`**, byte-identical fleet-wide. The
+  four `npm ci --legacy-peer-deps` steps in `CI.yaml` and `npm-publish.yml`
+  become plain `npm ci`: the setting now lives in one place, local installs
+  and Dependabot included, and the gate above enforces the ranges it no
+  longer checks.
+
+### Changed
+
+- **Peers `@astrojs/react` `^6.0.1` → `^6.0.1 || ^7.0.0` and
+  `@astrojs/starlight` `^0.41.3` → `^0.41.3 || ^0.42.0`**, matching
+  `@mano8/astro-auth-m8` `2.7.2`. `src/` imports neither package. Starlight
+  0.42 is the line built for `astro` 7.3, whose optional
+  `@astrojs/markdown-remark` `^7.3.0` peer Starlight 0.41 cannot meet.
+- `@mano8/astro-ui-m8` floor `^1.5.2` → `^1.5.3` (`dependencies`) and
+  `@mano8/astro-auth-m8` `^2.7.1` → `^2.7.2` (`peerDependencies` and
+  `devDependencies`, still equal), the newest published releases, each read
+  back as npm `latest`. The README states the new floors.
+- Dev dependencies test the new lines, matching `fa-ui-m8`: `@astrojs/react`
+  `^7.0.0`, `@astrojs/starlight` `^0.42.4`, `astro` `^7.3.4`, `react` /
+  `react-dom` / `@types/react` `^19.3.0`, `@typescript-eslint/*` `^8.70.1`,
+  `globals` `^17.12.0`. `@types/react-dom` `^19.3.0` is now declared: it is
+  a required peer of `@astrojs/react` that npm no longer installs on its own.
+
+## [2.3.1] - 2026-09-26 · tracks media-service 3.0.2
+
+**Patch.** Tracks the published `@mano8/astro-ui-m8` `1.5.2` and
+`@mano8/astro-auth-m8` `2.7.1` (`B39-astro-ui-changelog-release`, finding
+`G38`). The only shipped change is `package.json`'s floors, with the README
+that states them. The contract stays `media-service-m8@1.1`, range
+`>=2.0.0 <4.0.0`, and the tested service version stays `3.0.2`.
+
+### Added
+
+- **A lock that does not pin every package fails the build**
+  (`B34-npm-lock-integrity-guard`, finding `G34`(b)).
+  `scripts/verify-lock-integrity.mjs` (`npm run verify:lock-integrity`)
+  refuses a `package-lock.json` below `lockfileVersion` 3, or one with any
+  entry that lacks `integrity` or `resolved`, carries a non-`sha512` hash,
+  resolves outside `https://registry.npmjs.org/`, or is a link or `file:`
+  source, and names every offending key. `npm ci` installs an entry with no
+  `integrity` without checking a hash and says nothing, which is how `G33`
+  went unseen. CI runs it before `npm ci` in every job that installs.
+  `tests/lock-integrity.test.ts` proves each refusal against a fixture lock
+  and asserts this repository's own lock passes. The script is
+  dependency-free and byte-identical in the fleet's six npm repositories.
+  This lock already passed; the fixtures prove the red path. Only
+  `package.json`'s `scripts` gains an entry, so no release is owed.
+
+### Changed
+
+- `@mano8/astro-ui-m8` floor `^1.5.1` → `^1.5.2` (`dependencies`) and
+  `@mano8/astro-auth-m8` `^2.7.0` → `^2.7.1` (`peerDependencies` and
+  `devDependencies`, still equal), the newest published releases (§0.5's
+  explicit-pin rule). The lock moves those two entries, each with its
+  registry `resolved` and `sha512` `integrity`. The README states the new
+  floors.
+
+### Security
+
+- **The publish job verifies the lock before it installs**
+  (`B37-publish-lock-guard`, finding `G36`). `B34` guarded every `CI.yaml`
+  job but not the one that holds `id-token: write` and builds the tarball,
+  and the environment's `tag:v*` rule matches a tag by name, not by where it
+  points. `npm-publish.yml` now runs `npm run verify:lock-integrity` before
+  `npm ci`, and `tests/publish-workflow.test.ts` holds the order.
+
 ## [2.3.0] - 2026-09-26 · tracks media-service 3.0.2
 
 **Minor bump.** Tracks the published `media-service-m8` `3.0.2` patch release

package/README.md

@@ -65,12 +65,12 @@ elsewhere.
 npm i @mano8/astro-media-m8 @mano8/astro-auth-m8 zod
 ```
 
-`@mano8/astro-auth-m8` is a required peer at **`^2.7.0` or newer**:
+`@mano8/astro-auth-m8` is a required peer at **`^2.7.2` or newer**:
 `media-service-m8` only accepts `fa-auth-m8`-issued tokens, so the plugin's auth
 adapter must be backed by `fa-auth-m8` (the official plugin, or a custom adapter
 that obtains those tokens). A 1.x auth is not supported — upgrade auth first, or
 the install resolves nothing that satisfies the peer.
-`@mano8/astro-ui-m8` (`^1.5.1`) is a normal dependency because the media registry
+`@mano8/astro-ui-m8` (`^1.5.3`) is a normal dependency because the media registry
 skins compose the canonical shared table from its packaged registry output.
 `react`/`react-dom` are optional — only `./react`, `./hooks` and the starter
 views need them; `@tanstack/react-query` is a required peer once you use

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mano8/astro-media-m8",
-  "version": "2.3.0",
+  "version": "2.3.2",
   "description": "Astro integration and headless client for media-service-m8.",
   "type": "module",
   "license": "MIT",
@@ -56,7 +56,9 @@
     "build:registry": "node scripts/build-registry.mjs",
     "preview:dev": "vite --config fixtures/preview/vite.config.ts",
     "preview:build": "tsc -p fixtures/preview/tsconfig.json --noEmit && vite build --config fixtures/preview/vite.config.ts",
+    "verify:dependency-compat": "node scripts/verify-dependency-compat.mjs",
     "verify:fleet-gates": "node scripts/verify-fleet-gates.mjs",
+    "verify:lock-integrity": "node scripts/verify-lock-integrity.mjs",
     "verify:registry-consumer": "node scripts/verify-registry-consumer.mjs",
     "verify:registry-drift": "node scripts/verify-registry-drift.mjs",
     "verify:starter-routes": "node scripts/verify-starter-routes.mjs",
@@ -67,12 +69,12 @@
     "test:unit": "vitest run"
   },
   "dependencies": {
-    "@mano8/astro-ui-m8": "^1.5.1"
+    "@mano8/astro-ui-m8": "^1.5.3"
   },
   "peerDependencies": {
-    "@astrojs/react": "^6.0.1",
-    "@astrojs/starlight": "^0.41.3",
-    "@mano8/astro-auth-m8": "^2.7.0",
+    "@astrojs/react": "^6.0.1 || ^7.0.0",
+    "@astrojs/starlight": "^0.41.3 || ^0.42.0",
+    "@mano8/astro-auth-m8": "^2.7.2",
     "@tanstack/react-query": "^5.102.8",
     "astro": "^7.0.9",
     "react": "^18.0.0 || ^19.0.0",
@@ -88,25 +90,26 @@
     }
   },
   "devDependencies": {
-    "@astrojs/react": "^6.0.4",
-    "@astrojs/starlight": "^0.41.10",
+    "@astrojs/react": "^7.0.0",
+    "@astrojs/starlight": "^0.42.4",
     "@eslint-react/eslint-plugin": "^5.18.6",
     "@eslint/js": "^10.0.1",
-    "@mano8/astro-auth-m8": "^2.7.0",
+    "@mano8/astro-auth-m8": "^2.7.2",
     "@tanstack/react-query": "^5.102.8",
     "@tanstack/react-table": "^8.21.3",
     "@types/node": "^26.4.0",
-    "@types/react": "^19.2.18",
-    "@typescript-eslint/eslint-plugin": "^8.68.0",
-    "@typescript-eslint/parser": "^8.68.0",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "@typescript-eslint/eslint-plugin": "^8.70.1",
+    "@typescript-eslint/parser": "^8.70.1",
     "@vitest/coverage-v8": "^4.1.11",
-    "astro": "^7.2.9",
+    "astro": "^7.3.4",
     "eslint": "^10.9.1",
     "eslint-plugin-security": "^4.0.1",
-    "globals": "^17.11.0",
+    "globals": "^17.12.0",
     "jsdom": "^30.0.1",
-    "react": "^19.2.8",
-    "react-dom": "^19.2.8",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0",
     "typescript": "^5.9.3",
     "vitest": "^4.1.11",
     "zod": "^4.5.4"